Firestarter malware bypasses Cisco firewall security updates in the U.S. and U.K

Firestarter malware is evading security patches on Cisco firewall devices, according to U.S. and U.K. cybersecurity agencies. The sophisticated backdoor, attributed to a cyberespionage group, exploits vulnerabilities to maintain access even after devices are updated. Initial compromise likely occurred in September 2025. Agencies recommend reimaging affected devices and provide detection methods. A cold restart is a temporary workaround but carries risks.